provision: fix nTSecurityDescriptor attributes of CN=*,${CONFIGDN} (bug #9481)